My point is they are crippling the functionality of the computer to achieve a marginal security improvement. The insecurity largely resides on the applications,

My point is they are crippling the functionality of the computer to achieve a marginal security improvement. The insecurity largely resides on the applications, which it barely touched on. Snaps are great, but anything that can touch X is a problem. Profiles for AppArmor are tricky to get right. If they want to do confinement then dockerised apps is much more effective than treating the end user as the primary threat to guard against. All the effort to prevent end users running binaries won't stop ROP gadgets or prevent kernel breaks. Adding 2FA for login, decent firewall and container networking rules, and syslog reporting, would be far more useful than their bizarre paranoia about users running scripts. The complaint about LUKS is also bizarre, because the work function for trying one passphrase is enormous by default, and easily configured to be stupendously costly (e.g 30s). Its also quite feasible to boot from a USB key, which has a passphrase wrapped key; when separated from the computer this is very secure. TPM isn't foolproof either, so it comes across as rather ill informed.